What is the severity of CVE-2022-41929?

CVE-2022-41929 is considered a medium severity vulnerability due to its potential to allow unauthorized user modifications.

How do I fix CVE-2022-41929?

To fix CVE-2022-41929, update XWiki to the latest version where the authorization checks for User#setDisabledStatus have been properly implemented.

Who is affected by CVE-2022-41929?

CVE-2022-41929 affects XWiki versions from 11.7 to 13.10.7 and from 14.0.0 to 14.4.2, including specific release candidates and updates.

What type of access is improperly authorized in CVE-2022-41929?

CVE-2022-41929 allows users with Script rights to enable or disable accounts, which is intended only for users with admin rights.

Can CVE-2022-41929 be exploited by any user?

While CVE-2022-41929 primarily targets users with Script rights, any such user could exploit this vulnerability to bypass normal user management restrictions.

Vulnerability/
CVE-2022-41929

medium

4.9

CWE

862

23/11/2022

3/8/2024

CVE-2022-41929: Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore

First published: Wed Nov 23 2022(Updated: )

org.xwiki.platform:xwiki-platform-oldcore is missing authorization in User#setDisabledStatus, which may allow an incorrectly authorized user with only Script rights to enable or disable a user. This operation is meant to only be available for users with admin rights. This problem has been patched in XWiki 13.10.7, 14.4.2 and 14.5RC1.

Credit: security-advisories@github.com

Affected Software	Affected Version	How to fix
Xwiki	>11.7<13.10.7
Xwiki	>14.0.0<14.4.2
Xwiki	=11.7-rc1
Xwiki	=14.4.3
Xwiki	=14.4.4

Remedy

https://github.com/xwiki/xwiki-platform/commit/0b732f2ef0224e2aaf10e2e1ef48dbd3fb6e10cd

Remedy

https://jira.xwiki.org/browse/XWIKI-19804

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2022-41929?
CVE-2022-41929 is considered a medium severity vulnerability due to its potential to allow unauthorized user modifications.
How do I fix CVE-2022-41929?
To fix CVE-2022-41929, update XWiki to the latest version where the authorization checks for User#setDisabledStatus have been properly implemented.
Who is affected by CVE-2022-41929?
CVE-2022-41929 affects XWiki versions from 11.7 to 13.10.7 and from 14.0.0 to 14.4.2, including specific release candidates and updates.
What type of access is improperly authorized in CVE-2022-41929?
CVE-2022-41929 allows users with Script rights to enable or disable accounts, which is intended only for users with admin rights.
Can CVE-2022-41929 be exploited by any user?
While CVE-2022-41929 primarily targets users with Script rights, any such user could exploit this vulnerability to bypass normal user management restrictions.

agent/type
agent/softwarecombine
agent/remedy
collector/mitre-cve
source/MITRE
agent/author
agent/severity
agent/title
agent/weakness
agent/references
agent/last-modified-date
agent/first-publish-date
agent/description
agent/event
agent/source
agent/tags
collector/nvd-index
agent/software-canonical-lookup-request
vendor/xwiki
canonical/xwiki
version/xwiki/11.7-rc1
version/xwiki/14.4.3
version/xwiki/14.4.4

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.